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Safety and Reliability Engineers 


Provide the check and balance between Design Engineering and Systems 
Engineering to prevent catastrophic loss by identifying the single-failure 
points in systems. 

• They support Systems, Design, Processing, Quality, Manufacturing, and Operations 
Engineers by 

- Anticipating failures by performing various analyses and making 
recommendations during the system's design phase. 

- Authoring new and revising existing safety requirements and standards. 


- Performing mishap investigations and/or failure analyses. 

- Supporting launch activities. 

- Documenting lessons learned. 
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Apollo 1 



On January 27, 1967, tragedy struck the Apollo program when a flash 
fire occurred in command module 012 during a launch pad test of 
the Apollo/Saturn space vehicle being prepared for the first piloted 
flight, the AS-204 mission. 


• Three astronauts died in this tragic accident. 

- Lt. Col. Virgil I. Grissom, 

- Lt. Col. Edward H. White, and 







Apollo 1 

Contributing Factors and Root Cause 

• The test cabin pressure was over 16 psi, almost 2 psi above the ambient sea level pressure and near the upper 
limits of measuring devices in the spacecraft. Following a worldwide survey of artificial oxygen-rich environments, 
it was found that rarely if ever had a 100% oxygen environment been created and maintained at such a high 
pressure. Note: A bar of aluminum can burn like wood in this environment. 

• 34 square feet (3.2 m 2 ) of Velcro was installed throughout the spacecraft and Velcro was later found to be 
explosive in a high-pressure, 100% oxygen environment. 

• Up to 70 lbs of other non-metallic, flammable materials had also been incorporated into the design. 

• Substandard wiring and plumbing was found along with a misplaced socket wrench. 

• Sloppy workmanship, poor inspection, and inadequate safety design led to the accident. 

- A silver-plated copper wire was running through an environmental control unit near the Command 
Module pilot's couch which had become stripped of its Teflon insulation and abraded by repeated 
opening and closing of a small access door. This weak point in the wiring also ran near a junction in an 
ethylene glycol/water cooling line which was known to be prone to leaks. The electrolysis of ethylene 
glycol solution with the silver anode was a notable hazard which could cause a violent exothermic 
reaction, igniting the ethylene glycol mixture in the CM's corrosive test atmosphere of pure, high- 
pressure oxygen. 

• In 1968, MIT physicists performed a static discharge test in the CM-103 command module of Apollo 8. With an 
electroscope, they measured the approximate energy of static discharges caused by a test crew dressed in nylon 
flight pressure suits and reclining on the nylon flight seats. The MIT investigators found sufficient energy for 
ignition discharged repeatedly when crewmembers shifted in their seats and then touched the spacecraft's 
aluminum panels. However, the ignition source for the Apollo 1 fire was never officially determined. 

Source: Wiki Summary 




Apollo 1 

Design and Workmanship Changes made after Apollo 1 


• At launch, the cabin atmosphere would be at sea-level pressure and consist of 60% oxygen 
and 40% nitrogen, lowering to 5 psi during ascent, and gradually changing over to 100% 
oxygen at about 2 psi during the first 24 hours of the trans-lunar coast. 

• An explosive hatch would open outward in less than ten seconds. The redesigned hatch used 
a cartridge of pressurized nitrogen to drive the release mechanism in an emergency, as 
opposed to the pyrotechnic bolts used on Mercury. 

• Flammable materials in the cabin were replaced with self-extinguishing versions. 

• Plumbing and wiring were covered with protective insulation. 1,407 wiring problems were 
corrected. 


• Nylon suits were replaced with suits made of early Beta cloth, a non-flammable, highly melt- 
resistant fabric woven from silica and coated with glass. 

• Thorough protocols were implemented for documenting spacecraft construction and 
maintenance. 


Source: Wiki Summary 


Apollo XIII 

En route to the Moon, Mission Control had asked the crew to stir the 

hydrogen and oxygen tanks, destratifying the contents and increasing the 
accuracy of their quantity readings. 

• The number two oxygen tank, one of two in the Service Module 
(SM), exploded. 

• The resulting fire rapidly increased pressure beyond its nominal 
1,000 PSI (7 MPa) limit and either the tank or the tank dome failed. 

• All three astronauts survived. 

— James A. Lovell, Jr. 

— John L. Swigert, Jr. 

- Fred W. Haise, Jr. 




Source: Wiki Summary 



Apollo XIII 

Contributing Factors and Root Cause 

After an intensive investigation, the Apollo 13 Accident Review Board identified the cause of the 
explosion: 

• In 1965, the CM had undergone many improvements, which included raising the permissible 
voltage to the heaters in the oxygen tanks from 28 to 65 volts DC. The thermostatic switches 
on the heaters weren't modified. 

• During one final test on the launch pad, the heaters were on for a long period of time. "This 
subjected the wiring in the vicinity of the heaters to very high temperatures (1000 F), which 
have been subsequently shown to severely degrade teflon insulation. The thermostatic 
switches started to open while powered by 65 volts DC and were probably welded shut." 

• Other warning signs during testing went unheeded and the tank, damaged from 8 hours of 
overheating, was a potential bomb the next time it was filled with oxygen. 

• That bomb exploded on April 13, 1970 -- 200,000 miles from Earth. 

Source: NASA 



Apollo XIII 

Contributing Factors and Root Cause 

Tank components relevant to the accident: a quantity sensor; a fan to stir the tank contents for more accurate quantity measurements; a heater to 
vaporize liquid oxygen as needed; a thermostat to protect the heater; a temperature sensor; and fill and drain valves and piping. 

The heater and protection thermostat were originally designed for the command module's 28-volt DC bus. However, their specifications were changed 
to allow a 65-volt ground supply to pressurize the tanks more rapidly. The thermostat was never upgraded to handle the higher voltage. 

The temperature sensor could not read above the highest operational temperature of the heater, about 100 °F (38 °C). Ordinarily, this was not a 
problem because the thermostat was designed to open at 80 °F (27 °C). 

The oxygen shelf carrying the oxygen tanks was originally installed in the Apollo 10 service module. It was removed to fix a potential electromagnetic 
interference problem. During removal, the shelf was accidentally dropped about 2 inches (5.1 cm) because a retaining bolt had not been removed. The 
tank appeared undamaged but a loosely fitting filling tube was apparently damaged, and photographs suggested that the close-out cap on the top of 
the tank may have hit the fuel cell shelf. The report of the Apollo 13 review board considers the probability of tank damage during this incident to be 
"rather low". 

After the tank was filled for ground testing, it could not be emptied through the normal drain line. To avoid delaying the mission to replace the tank, 
the heater was connected to 65V ground power to boil off the oxygen. Lovell signed off on this procedure. It should have taken a few days at the 
thermostatic opening temperature of 80 °F (27 °C). However, when the thermostat opened, the 65-volt supply fused its contacts closed and the heater 
remained powered. This raised the temperature of the heater to an estimated 1,000 °F (538 °C). 

A chart recorder on the heater current showed that the heater was not cycling on and off, as it should have been if the thermostat was functioning 
correctly, but no one noticed it at the time. 

Because the temperature sensor could not read higher than 100 °F (38 °C), the monitoring equipment did not register the true temperature inside the 
tank. The gas evaporated in hours rather than days. 

The sustained high temperatures melted the Teflon insulation on the fan power supply wires and left them exposed. Damaged insulation on the Teflon 
wires to the stirrer motor in oxygen tank 2 allowed them to short and ignite the insulation. 

When the tank was refilled with oxygen, it became a bomb waiting to go off. During the "cryo stir" procedure, fan power passed through the bare 
wires that had shorted, producing sparks and igniting the Teflon. This in turn boiled liquid oxygen faster than the tank vent could remove it. 

The other oxygen tank or its piping, located near the failed tank, was damaged allowing it to leak as well. Design changes included moving the tanks 
farther apart, adding a third tank, and an emergency battery to another sector in the service module. 



Source: Wiki 


STS-51L - Challenger 

On January 28, 1986, Space Shuttle Challenger broke apart 73 seconds into 
flight due to a poor joint seal in the Right Solid Rocket Booster. 

• All seven of Challenger's crew members perished in the accident. 

- Michael J. Smith, 









STS-51L - Challenger 

Contributing Factors and Root Cause 

• In the STS-51L design, the application of actuating pressure to 
the upstream face of the O-ring was essential for proper joint 
sealing performance because large sealing gaps were created 
by pressure-induced deflections, compounded by significantly 
reduced O-ring sealing performance at low temperature. 

• The major change in the motor case is the new tang capture feature to 
provide a positive metal-to-metal interference fit around the 
circumference of the tang and clevis ends of the mating segments. 

• The interference fit limits the deflection between the tang and clevis 
O-ring sealing surfaces caused by motor pressure and structural loads. 
The joints are designed so that the seals will not leak under twice the 
expected structural deflection and rate. 

Source: NASA 
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STS-51L - Challenger 

Solid Rocket Booster Design Changes 

• The new design, with the tang capture feature, the interference fit, and the use of custom shims between the 
outer surface of the tang and inner surface of the outer clevis leg, controls the O-ring sealing gap dimension. The 
sealing gap and the O-ring seals are designed so that a positive compression (squeeze) is always on the O-rings. 
The minimum and maximum squeeze requirements include the effects of temperature, O-ring resiliency and 
compression set, and pressure. The clevis O-ring groove dimension has been increased so that the O-ring never 
fills more than 90 % of the O-ring groove and pressure actuation is enhanced. 

• The new field joint design also includes a new O-ring in the capture feature and an additional leak check port to 
ensure that the primary O-ring is positioned in the proper sealing direction at ignition. This new, or third, O-ring 
also serves as a thermal barrier in case the sealed insulation is breached. 

• The field joint internal case insulation was modified to be sealed with a pressure-actuated flap called a J-seal, 
rather than with putty as in the STS-51L configuration. 

• Longer field-joint-case mating pins, with a reconfigured retainer band, were added to improve the shear strength 
of the pins and increase the metal parts' joint margin of safety. The joint safety margins, both thermal and 
structural, are being demonstrated over the full ranges of ambient temperature, storage compression, grease 
effect, assembly stresses and other environments. External heaters with integral weather seals were incorporated 
to maintain the joint and O-ring temperature at a minimum of 75 deg F. The weather seal also prevents water 
intrusion into the joint. 

• The SRM case-to nozzle joint, which experienced several instances of O-ring erosion in flight, has been redesigned 
to satisfy the same requirements imposed upon the case field joint. Similar to the field joint, cast-to-nozzle joint 
modifications have been made in the metal parts, internal insulation and O-rings. Radial bolts with Stato-O-Seals 
were added to minimize the joint sealing gap opening. The internal insulation was modified to be sealed 
adhesively, and third O-ring was included. The third O-ring serves as a dam or wiper in front of the primary O-ring 
to prevent the polysulfide adhesive from being extruded into the primary O-ring groove. It also serves as a thermal 
barrier in case the polysulfide adhesive is breached. The polysulfide adhesive replaces the putty used in the STS- 
51L joint. Also, an additional leak check port was added to reduce the amount of trapped air in the joint during 
the nozzle installation process and to aid in the leak check procedure. 



STS-51L - Challenger 


Additional Design Changes Made to SRB Components 

• NOZZLE - The internal joints of the nozzle metal parts have been redesigned to incorporate redundant and verifiable O-rings at each joint. The nozzle 
steel fixed housing part has been redesigned to permit the incorporation of the 100 radial bolts that attach the fixed housing to the case's aft dome. 
Improved bonding techniques are being used for the nozzle nose inlet, cowl/boot and aft exit cone assemblies. The distortion of the nose inlet 
assembly's metal-part-to-ablative-parts bond line has been eliminated by increasing the thickness of the aluminum nose inlet housing and improving 
the bonding process. The tape-wrap angle of the carbon cloth fabric in the areas of the nose inlet and throat assembly parts was changed to improve 
the ablative insulation erosion tolerance. Some of these ply-angle changes were in progress prior to STS-51L. The cowl and outer boot ring has 
additional structural support with increased thickness and contour changes to increase their margins of safety. Additionally, the outer boot ring ply 
configuration was altered. 

• FACTORY JOINT - Minor modifications were made in the case factory joints by increasing the insulation thickness and lay-up to increase the margin of 
safety on the internal insulation. Longer pins were also added, along with a reconfigured retainer band and new weather seal to improve factory joint 
performance and increase the margin of safety. Additionally, the O-ring and O-ring groove size was changed to be consistent with the field joint. 

• PROPELLANT - The motor propellant forward transition region was recontoured to reduce the stress fields between the star and cylindrical portions 
of the propellant grain. 

• IGNITION SYSTEM - Several minor modifications were incorporated into the ignition system. The aft end of the igniter steel case, which contains the 
igniter nozzle insert, was thickened to eliminate a localized weakness. The igniter internal case insulation was tapered to improve the manufacturing 
process. Finally, although vacuum putty is still being used at the joint of the igniter and case forward dome, it was changed to eliminate asbestos as 
one of its constituents. 

• GROUND SUPPORT EQUIPMENT - The ground support equipment has been redesigned to (1) minimize the case distortion during handling at the 
launch site; (2) improve the segment tang and clevis joint measurement system for more accurate reading of case diameters to facilitate stacking; (3) 
minimize the risk of O-ring damage during joint mating; and (4) improve leak testing of the igniter, case and nozzle field joints. A Ground Support 
Equipment (GSE) assembly aid guides the segment tang into the clevis and rounds the two parts with each other. Other GSE modifications include 
transportation monitoring equipment and lifting beam. 

• DESIGN ANALYSIS SUMMARY - Improved, state-of-the-art, analyses related to structural strength, loads, stress, dynamics, fracture mechanics, gas 
and thermal dynamics, and material characterization and behavior were performed to aid the field joint, nozzle-to-case joint and other designs. 
Continuing these analyses will ensure that the design integrity and system compatibility adhere to design requirements and operational use. These 
analyses will be verified by tests, whose results will be correlated with pretest predictions. 

• VERIFICATION/CERTIFICATION TEST - The verification program demonstrates that the RSRM meets all design and performance requirements, and 
that failure modes and hazards have been eliminated or controlled. The verification program encompasses the following program phases: 
development, certification, acceptance, preflight checkout, flight, and post-flight. 

• Redesigned SRM certification is based on formally documented results of development motor tests; qualification motor tests and other tests and 
analyses. The certification tests are conducted under strict control of environments, including thermal and structural loads; assembly, inspection and 
test procedures; and safety, reliability, maintainability and quality assurance surveillance to verify that flight hardware meets the specified 
performance and design requirements. The "Development and Verification Plan" stipulates the test program, which follows a rigorous sequence 
wherein successive tests build on the results of previous tests leading to formal certification. 

Source: NASA 




STS-107 - Columbia 


On February 1, 2003, the Space Shuttle Columbia disintegrated over Texas 
during re-entry into the Earth's atmosphere due to a hole in the left wing's 
RCC that allowed hot gasses to enter the structure and melt it. 


• All seven astronauts perished in the accident 


- Rick D. Husband, 

- William C. McCool, 

- Michael P. Anderson, 

- Nan Ramon, 

- Kalpana Chawla, 

- David M. Brown, 

- Laurel Clark. 



Source: Wiki Summary 
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STS-107 - Columbia 


"In four simple words, the foam did it." 

- Scott Hubbard, Deputy Director for Research at 
NASA Ames Research Center 








STS- 107 - Columbia 
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STS-107 - Columbia 

Contributing Factors and Root Cause 

The investigation focused on the foam strike from the very beginning. 

• Incidents of debris strikes from ice and foam causing damage during take-off 
were already well known, and had actually damaged orbiters, most noticeably 
during STS-45, STS-27, and STS-87. 

• Normally, engineers notice a phenomenon known as "popcorning" on the intertank 
foam, in which "you have small air bubbles in that area and in the heating of ascent 
they'll expand and pop off," John Shannon said. "Usually, that's in the two-and-a- 
half to three-minute timeframe on the flight/' - CNET 

• "The root cause of TPS foam debris shedding has been attributed to internal 
defects (voids) within the foam structure. Entrapped gas or liquid 
nitrogen/liquid air within the defect (void) expands during ascent due to the 
reduced ambient pressure and aerodynamic heating. Depending on the size, 
depth and geometry of the defect, the resultant pressure differential may 
cause failure of the surrounding foam. This type of failure mode has been 
identified as "cohesive" failure and results in chunks of foam being shed from 
the tank." - NASA ESC 


Source: Wiki Summary CNET. and NASA ESC 




k STS-107 - Columbia 

F Culture and Cognitive Bias as Contributing Factors 

Similar to the Challenger disaster, NASA management failed to recognize the relevance of engineering concerns for safety. Two examples 
were failure to honor engineer requests for imaging to inspect possible damage, and failure to respond to engineers' requests about the 
status of astronaut inspection of the left wing. 

- Engineering made three separate requests for Department of Defense (DOD) imaging of the orbiter to more precisely determine 
damage. While the images were not guaranteed to show the damage, the capability existed for imaging of sufficient resolution to 
provide meaningful examination. In fact, the CAIB recommended subsequent missions be imaged while in orbit using ground-based 
or space-based Department of Defense assets. NASA management did not honor the requests and in some cases intervened to stop 
the DOD from assisting. 

- NASA's chief thermal protection system (TPS) engineer was concerned about left wing TPS damage and asked NASA management 
whether an astronaut would visually inspect it. NASA managers never responded. 

Throughout the risk assessment process, senior NASA managers were influenced by their belief that nothing could be done even if damage 
was detected; hence, this affected their stance on investigation urgency, thoroughness, and possible contingency actions. They decided to 
conduct a parametric "what-if" scenario study more suited to determine risk probabilities of future events, instead of inspecting and 
assessing the actual damage. 

• Much of the risk assessment hinged on damage predictions to the thermal protection system. These fall into two categories: 

damage to the silica tile on the wing lower surface, and damage to the reinforced carbon-carbon (RCC) leading-edge panels. 

Damage-prediction software was used to evaluate possible tile and RCC damage. The tool for predicting tile damage was known as 
"Crater", described by several NASA representatives in press briefings as not actually a software program but rather a statistical 
spreadsheet of observed past flight events and effects. The "Crater" tool predicted severe penetration of multiple tiles by the impact if it 
struck the TPS tile area, but NASA engineers downplayed this. The engineers believed that results showing that the model overstated 
damage from small projectiles meant that the same would be true of larger Spray-On Foam Insulation (SOFI) impacts. The program used to 
predict RCC damage was based on small ice impacts the size of cigarette butts, not larger SOFI impacts, as the ice impacts were the only 
recognized threats to RCC panels up to that point. Under 1 of 15 predicted SOFI impact paths, the software predicted an ice impact would 
completely penetrate the RCC panel. Engineers downplayed this, too, believing that impacts of the less dense SOFI material would result in 
less damage than ice impacts. In an e-mail exchange, NASA managers questioned whether the density of the SOFI could be used as 
justification for reducing predicted damage. Despite engineering concerns about the energy imparted by the SOFI material, NASA 
managers ultimately accepted the rationale to reduce predicted damage of the RCC panels from possible complete penetration to slight 
damage to the panel's thin coating. 

Ultimately, the NASA Mission Management Team felt there was insufficient evidence to indicate that the strike was an unsafe situation; 
therefore, they declared the debris strike a "turnaround" issue (not of highest importance) and denied the requests for the Department of 
Defense images. 


Source: Wiki Summary 





STS-107 - Columbia 


Dozens of changes were made 

• The ET bi-pod is susceptible to icing due to the ultra-cold fuel. Until the Columbia accident, the ET bi-pod was protected 
from ice buildup using thick sheets of foam. The improved bi-pod design now relies on electric heaters versus foam to keep 
the area clear of ice. 

• NASA added a heater to the LOX Feedline bellows and installing a foam "drip-lip" that prevents condensation from building 
up and freezing as the liquid oxygen (LOX) feedline expand sand contract as it carries fuel from the External Tank to the 
Orbiter. 

• NASA upgraded the short-, medium-, and long-range tracking camera system around the Center's launch pads 39A and 39B, 
along with those lining the nearby Atlantic coastline. The addition of nine camera sites provides unprecedented views of 
launch, allowing engineers to clearly observe the flight high into the sky. 

• The orbiters also received new imaging equipment with the installation of a digital External Tank camera. 

• On-orbit, the R-Bar Pitch Maneuver (RPM) is performed to allow the ISS crew to visually inspect and photograph the belly of 
the orbiter for damage. 

• The Canadian-built Orbiter Boom Sensor System boom extension houses a camera and laser-powered measuring device that 
astronauts use to scan the orbiter's exterior. The boom attaches to the end of the existing robotic arm and doubles its length 
to 100 feet, allowing the arm to reach around the spacecraft for the best possible views. 

• Each of Discovery's leading wing edges are outfitted with temperature sensors to measure how heat is distributed across 
their spans and accelerometers to detect impacts and gauge their strength and location. The sensors are highly sensitive and 
take 20,000 readings per second. 

• On Earth, flash thermography is used to examine the Reinforced Carbon-Carbon panels that make up the wing's leading 
edges. The technique starts by applying an intensely hot and bright burst of light to the panels. Technicians then survey the 
panels with a heat-sensitive infrared camera to see if any flaws appear under stress from the extreme heat. 

• "NASA has redesigned the way foam is applied to the tank to minimize "shedding" and to prevent large pieces from breaking 
away. "-CNET 

• The Columbia Crew Survival Investigation Report made further recommendations to improve a crew's survival chances on 
future space vehicles. These include improvements in crew restraints, finding ways to deal more effectively with catastrophic 
cabin depressurization, more "graceful degradation" of vehicles during a disaster to provide crews with a better chance at 
survival, and automated parachute systems. 


Source: NASA and CNET 
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water Mtesion terminated early 
Crew 2 


Seivtoe, -decent module separation faiure 

VDStok 1.4/121961. Crew 1 

Vostok 2 8*6-1961. Crew: 1 

Vosok 5. 6/14/1963. Crew: 1 

Vostnod 2 2161965. Crew 1 

Soyuz 5. 1/18/1963, Crew: 1 

Soyuz TMA-10. 4*7.2007. Crew 3 

Soyuz TMA-1 1 . 10'1Q'2007 Crew 3 (1 injured) 


ISS EVA 10 624*2004 

EVA abored due to mts-oorhgured 
vave deperng Ortan Ch suppy at star 
Of EVA 
Crew 2 


Mr 2/1998 

Overheating bmp beds produce beam 
threaten ng level of COj 
Crew. 2 


Mr 6/261997 

Progress M-34 coiides with Mr Spektr 
pressure shell ruptured Spektr noame 
■ BM 
Crew 3 


Soyuz TM 17 1/14*1994 

Coiiaes twice wch Mir dirmg undocking 
Crew Soyuz 2. Mir 3 


Soyuz TW5 9/6*1968 

2 deortxt attempts rat: crew prevented 
erroneous irtng of separation pyre* 
Crew 2 


Soyuz 21 624/1976 

Separation Horn Sa/yut raned: ground 
command succeeded in ooenlng atches. 
Crew. Soyuz 3. Saiyut 3 


V36khod 2 3/18/1965 

EVA cosmonaut unable to re-enter 
a roc* unoi sur deoressurtzed to <3 pel 
Crew 2 


X-15 3-65-9 
i Sub-crb tai * 

Electrlca shoe and crew error 
lead to loss of control at 
230,000 feet Flight system 
preverts recover. 

Aerodynamic break uo 
Crew: 1 Lom of Crew 



[STS-1 07 21.2003 

TPS damage Tom ascent deors 
strke results in thema faiure of 
structure during entry 
Crew 7 LoeeoTCrew 



Other sign next STS TPS 
anomalies. STS: 1,6.41 B. 51G. 
27*. 28.40.42 

* Most severe tke damage to date 


Soyuz TM-7 427/1989 

Double-impact *hard landing* 

Coe cosmonaut required medlca 
treatment. 

Crew 2 Crew injury 


Mercury MA-7 S24-1962 1 
RCS depeton at 9C.000 ft | 
Crew 1 


Soyuz 36 7/31/1980 

Lardng engine falls to lire -30G 
impact 
Crew 2 


STS-9 12-16-1983 

A| Two APUs caught fire durng 
rollout, B| GPC tailed on 
touchdown. C) moorrect FC 
rechameiizabon x rollout. 
Crew 6 


fepifl 10/161976 

Splashdown in frozen lake during 
bizzard 
Crew 2 


f lApalOASTP 7/24/1975 | 

|Mj 0 4 in crew caun. Crew m 
hosptaibr2 weeks 
pew3^_^_ Crew mjixy 

Soyuz 1 424-1967 

Parachute Allure. 

Crew 1 Loss of Crew 


Apollo 15 8/7/1971 

Lands wwi only 2 of 3 parachutes 
Crew 3 


Mercury MR-4 7.21/1961 

inadvertent natch pyro flmg 
Capsule sunk. Astronaut neany 


Lose of Capsule 


The JSC Flight Safety Office maintains the Significant Incidents and Close Calls In Human Spaceflight graphic to provide continuing visibility of the risks inherent with space exploration and 
provide engineers with a summary of past experience. It is hoped this information will be used to leam from the past and make present and future missions safer. 









